...
- Make sure the HttpClient bean's
tLSSocketFactory-refproperty points to the shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLS bean. - Configure the component's injected HttpClientSecurityParameters instance's
clientTLSCredentialproperty with an X.509 credential.
The syntax for supplying a keypair can be essentially copied from the credentials.xml file that contains the more "usual" keys and certificates used by the IdP. Note that the beans defined in that file are not visible outside the RelyingPartyConfiguration so if you try to reuse them elsewhere, you'll get errors.
| Code Block |
|---|
<bean id="CustomHttpSecurity" class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
<property name="clientTLSCredential">
<bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{idp.home}/credentials/tlsclient.key"
p:certificateResource="%{idp.home}/credentials/tlsclient.crt" />
</property>
</bean>
<!-- Sample feature we're actually trying to use, which we inject custom rules into. -->
<bean id="PushReporter" parent="shibboleth.metrics.HTTPReporter" c:name="MyCollector"
p:httpClient-ref="CustomHttpClient"
p:httpClientSecurityParameters-ref="CustomHttpSecurity"
p:collectorURL="https://log.example.org/cgi-bin/collector.cgi" /> |
HTTP Authentication
TBD
Reference
...
| Name | Type | Description |
|---|---|---|
shibboleth.NonCachingHttpClient NonCachingHttpClient | HttpClientFactoryBean | Factory bean for non-caching HTTP client |
| shibboleth.FileCachingHttpClient | FileCachingHttpClientFactoryBean | Factory bean for file-based-caching HTTP client |
shibboleth.MemoryCachingHttpClient | InMemoryCachingHttpClientFactoryBean | Factory bean for in-memory-caching HTTP client |
| shibboleth.StaticExplicitTrustEngine 3.3 | StaticExplicitKeyFactoryBean | Factory bean for creating ExplicitKeyTrustEngine |
| shibboleth.StaticPKIXTrustEngine 3.3 | StaticPKIXFactoryBean | Factory bean for creating PKIXX509CredentialTrustEngine |
| shibboleth.SecurityEnhancedTLSSocketFactory 3.2 | SecurityEnhancedTLSSocketFactory | Socket factory that supports HttpClientSecurityParameters-aware components |
| shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLS 3.3 | SecurityEnhancedTLSSocketFactory | Client-TLS-capable socket factory that supports HttpClientSecurityParameters-aware components |
...